SSCP Systems Security Certified PractitionerIncident Response and RecoveryMedium
A company is conducting a Business Impact Analysis (BIA) to determine the potential financial and operational losses associated with various disruptions. They are currently focusing on the maximum tolerable downtime for their core payment processing system, which directly impacts revenue. What metric are they trying to establish?
- AMean Time To Recover (MTTR)
- BWork Recovery Time (WRT)
- CRecovery Time Objective (RTO)
- DRecovery Point Objective (RPO)
Show answer & explanationAnswer & explanation
Correct answer: C. Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) defines the maximum acceptable downtime for a system or service after a disaster or incident, directly addressing the 'maximum tolerable downtime' for the payment processing system.
Why the other options are wrong
- A. MTTR is the average time it takes to repair a failed system, not a predefined objective.
- B. WRT is the time needed to verify and make a system fully functional after RTO, not the RTO itself.
- D. RPO defines the maximum acceptable data loss, not downtime.
Recovery Time Objective (RTO)
The maximum acceptable duration of time that a business process or system can be unavailable after an incident or disaster without causing unacceptable consequences.
- Measured in time (hours, days).
- Determined by Business Impact Analysis (BIA).
- Dictates the speed of recovery.
Memory trick: RTO is 'Time' to get 'Online' again.